Posted on

2026-10-26 AGENTS.md Coding-Agent Hijack — Sentinel Hunts

Threat Overview

Forever Security reported a real customer incident in which a malicious `AGENTS.md` inside `~/Downloads` instructed a coding agent to install the malicious `function-color` npm package. The attempt was blocked; the observed case did not establish successful code execution. Researchers subsequently reproduced agent instruction hijacking against Codex, and a related `CLAUDE.md` configuration manipulation against Claude Code that exposed an OAuth token in laboratory tests. BleepingComputer published independent reporting on October 25, 2026. A browser-download delivery route was demonstrated but **not established** for the real incident. This is a trust-boundary failure involving agent working directories and instructions, not a CVE or confirmed defect in a particular version.

References

Impacted Systems

  • **Vendor/product:** OpenAI Codex coding agent; Anthropic Claude Code (related laboratory technique); npm/npx package manager and `function-color` package.
  • **Versions:** No affected or fixed product version identified; this is intended instruction-file behavior under unsafe trust assumptions.
  • **Platforms:** Developer workstations with coding agents on Windows, macOS, or Linux; Windows-specific fallback requires SecurityEvent 4688.
  • **Prerequisite:** Attacker-controlled `AGENTS.md`/`CLAUDE.md` in an agent-trusted working directory; agent launched there with sufficient tool permissions.
  • **Exposure:** Downloads and other untrusted writable directories used as coding-agent project roots.
  • **Unaffected:** Agent sessions that do not read the malicious file, or where permissions/sandbox prevent the requested action, are not shown to be compromised.

Why this matters

A small instruction file can cause a trusted developer tool to execute a package or modify its own credentials/configuration. Detectable endpoint signals include `function-color`, unauthorized MCP config writes, agent subprocess creation, and bypass flags; network logs alone are insufficient.

Exploitation Status

Real-world attempt blocked; laboratory demonstrations of Codex execution and Claude Code OAuth token exposure. Browser delivery to the real victim remains unknown. October 22 original research, October 25 reporting.

What this hunt looks for

Layered, behavior-first detection for the reported campaign, using available Microsoft Sentinel data. Each query requires its listed telemetry; no customer-specific execution is claimed.

Required logs

  • DeviceFileEvents
  • DeviceProcessEvents
  • SecurityEvent
  • Syslog

Hunt 01 — Exact malicious npm package execution from agent process

Required Sentinel telemetry: DeviceProcessEvents

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where ProcessCommandLine contains "function-color"
| where FileName in~ ("npm","npm.cmd","npx","npx.cmd","node","node.exe","sh","bash","cmd.exe","powershell.exe") or InitiatingProcessFileName in~ ("codex","codex.exe","node","node.exe","claude","claude.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

Hunt 02 — Instruction file created in Downloads by browser

Required Sentinel telemetry: DeviceFileEvents

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("AGENTS.md","CLAUDE.md")
| where FolderPath contains "Downloads" or FolderPath contains "/downloads/"
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","chrome","firefox")
| project TimeGenerated, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated desc

Hunt 03 — Codex bypassing approvals and sandbox

Required Sentinel telemetry: DeviceProcessEvents

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("codex","codex.exe","node","node.exe")
| where ProcessCommandLine contains "--dangerously-bypass-approvals-and-sandbox"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

Hunt 04 — Instruction file followed by Codex configuration change

Required Sentinel telemetry: DeviceFileEvents

let Instructions=DeviceFileEvents
| where TimeGenerated >= ago(30d) and FileName in~ ("AGENTS.md","CLAUDE.md") and FolderPath contains "Downloads"
| project DeviceId, DeviceName, InstructionTime=TimeGenerated, InstructionPath=FolderPath;
DeviceFileEvents
| where TimeGenerated >= ago(30d) and FileName in~ ("config.toml","settings.json")
| where FolderPath contains ".codex" or FolderPath contains ".claude"
| project DeviceId, ConfigTime=TimeGenerated, ConfigPath=FolderPath, ConfigFile=FileName, InitiatingProcessFileName
| join kind=inner Instructions on DeviceId
| where ConfigTime between (InstructionTime .. InstructionTime+2h)
| project InstructionTime, ConfigTime, DeviceName, InstructionPath, ConfigPath, ConfigFile, InitiatingProcessFileName
| order by ConfigTime desc

Hunt 05 — Codex or Claude invoking npm/npx as child process

Required Sentinel telemetry: DeviceProcessEvents

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("npm","npm.cmd","npx","npx.cmd","node","node.exe")
| where InitiatingProcessFileName in~ ("codex","codex.exe","claude","claude.exe") or InitiatingProcessCommandLine has_any ("codex","claude")
| where ProcessCommandLine has_any ("function-color","mcp","--yes","-y")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

Hunt 06 — Agent-related config modification by unexpected process

Required Sentinel telemetry: DeviceFileEvents

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("config.toml","settings.json")
| where FolderPath contains ".codex" or FolderPath contains ".claude"
| where ActionType in~ ("FileCreated","FileModified","FileRenamed")
| project TimeGenerated, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

Hunt 07 — Windows 4688 fallback for malicious package or agent sandbox bypass

Required Sentinel telemetry: SecurityEvent

SecurityEvent
| where TimeGenerated >= ago(30d) and EventID == 4688
| extend Cmd=tostring(column_ifexists("CommandLine", "")), Parent=tostring(column_ifexists("ParentProcessName", ""))
| where Cmd contains "function-color" or (Cmd contains "codex" and Cmd contains "--dangerously-bypass-approvals-and-sandbox")
| project TimeGenerated, Computer, Account, NewProcessName, Parent, Cmd, EventID
| order by TimeGenerated desc

Hunt 08 — Linux Syslog fallback for exact package and bypass markers

Required Sentinel telemetry: Syslog

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("function-color","--dangerously-bypass-approvals-and-sandbox")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

Detection Notes

Highest signal: exact `function-color` execution, instruction-file creation followed by agent config write, and agent sandbox bypass. `AGENTS.md` is commonly legitimate in software projects, and `npm` from coding agents is expected. File presence alone is not compromise. On macOS/Linux, Windows 4688 fallback does not apply. Exact package versions and other infrastructure were not established.

Scope: Results are limited to log sources and retention ingested into Microsoft Sentinel. No customer workspace was queried for this publication.

Leave a Reply